> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kavachos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# PayPal

> Authenticate users via PayPal OAuth 2.0. Enable Log In with PayPal in your developer app and configure the `paypal` provider with `profile` or `address` scopes.

## Setup

<Steps>
  <Step>
    ### Get credentials

    Go to the [PayPal Developer Portal](https://developer.paypal.com) and create an app under **My Apps & Credentials**. Add your redirect URI:

    ```
    https://your-app.com/api/kavach/auth/oauth/callback/paypal
    ```

    Make sure to enable **Log In with PayPal** for the app.
  </Step>

  <Step>
    ### Configure

    ```ts title="lib/kavach.ts" theme={"system"}
    import { createKavach } from 'kavachos';
    import { oauth } from 'kavachos/auth';

    const kavach = await createKavach({
      database: { provider: 'sqlite', url: 'kavach.db' },
      plugins: [
        oauth({
          providers: [
            {
              id: 'paypal',
              clientId: process.env.PAYPAL_CLIENT_ID!,
              clientSecret: process.env.PAYPAL_CLIENT_SECRET!,
            },
          ],
        }),
      ],
    });
    ```

    ```bash theme={"system"}
    PAYPAL_CLIENT_ID=...
    PAYPAL_CLIENT_SECRET=...
    ```
  </Step>
</Steps>

## Scopes

Default scopes: `openid`, `email`

| Scope     | What it unlocks     |
| --------- | ------------------- |
| `openid`  | OIDC identity token |
| `email`   | Email address       |
| `profile` | Name and locale     |
| `address` | Billing address     |

<Info>
  PayPal supports both sandbox and live environments. Use sandbox credentials during development and switch to live credentials before going to production.
</Info>

## Endpoints

| Method | Path                           | Description        |
| ------ | ------------------------------ | ------------------ |
| GET    | `/auth/oauth/authorize/paypal` | Redirect to PayPal |
| GET    | `/auth/oauth/callback/paypal`  | Handle callback    |